CVE-2024-13890 Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection

The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. This makes it possible for authenticated attackers, with Editor-level access a...

[SECURITY] Fedora 40 Update: vim-9.1.1169-1.fc40

VIM VIsual editor iMproved is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more...

WordPress Code Snippets CPT plugin <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Francesco Carlucci in WordPress Plugin Code Snippets CPT versions = 2.1.0...

SUSE-SU-2025:20136-1 Security update for pcr-oracle, shim

This update for pcr-oracle, shim fixes the following issues: pcr-oracle: - predict SbatLevelRT for the next boot bsc1230316 shim was updated to version 15.8: - Update shim-install to use the 'removable' way for encrypted SL-Micro images bsc1230316 Always use the removable way for SL-Micro Limit t...

CVE-2025-1768

CVE-2025-1768 affects the SEO Plugin by Squirrly SEO for WordPress. The vulnerability is a blind SQL Injection in the plugin’s search parameter, exploitable on all versions up to 12.4.05 due to insufficient escaping of user input and inadequate preparation of the SQL query. With Subscriber-level ...

CVE-2025-1768 SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to blind SQL Injection via the 'search' parameter in all versions up to, and including, 12.4.05 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2024-13805

The Advanced File Manager — Ultimate WordPress File Manager and Document Library Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.2.14 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-13787

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'vedabackupandrestoreaction' function. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13906

The CVE-2024-13906 entry pertains to Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress (WordPress plugin) versions

CVE-2025-1309

CVE-2025-1309 affects UiPress lite for WordPress. A missing capability check in uip_save_form_as_option() in all versions up to 3.5.04 allows authenticated users with Subscriber-level access or higher to modify arbitrary options, enabling privilege escalation (e.g., changing the default registrat...

CVE-2024-13526 EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the exportsubmittionattendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers,...

CVE-2024-13526

CVE-2024-13526 affects the EventPrime – Events Calendar, Bookings and Tickets WordPress plugin. The root cause is missing capability checks in the export_submittion_attendees function across all versions up to 4.0.7.3, enabling authenticated users with Subscriber-level access and higher to downlo...

WordPress plugin Wishlist 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin CS Framework 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

WordPress CS Framework plugin <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion vulnerability

Authenticated Subscriber+ Arbitrary File Deletion vulnerability discovered by Tonn in WordPress Plugin CS Framework versions = 7.0...

Ubuntu: Security Advisory (USN-7328-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-12815

The Point Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pointmaker' shortcode in all versions up to, and including, 0.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-13778

CVE-2024-13778 concerns the WordPress plugin Hero Mega Menu - Responsive WordPress Menu Plugin . The vulnerability is a SQL Injection in multiple functions across all versions up to and including 1.16.5 , caused by insufficient escaping of user-supplied input and lack of proper SQL statement prep...

CVE-2024-13811

CVE-2024-13811 concerns the Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme for WordPress (versions

CVE-2024-0141

NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to write to an unsupported registry causing a bad state. A successful exploit of this vulnerability may lead to denial of service...